MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SHA3-384 hash: 62a0810145288d4c3ebbf6628e6f7c3529fc650eaa9acc60d8c5471ef5321d50e948aada575223ac01469b5ef7a76ee9
SHA1 hash: 866b3f6fd77c703efb874eaf3cc518c3e86ac209
MD5 hash: b193c3393e07c06375d39d92c352c011
humanhash: montana-purple-magazine-yankee
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:476'160 bytes
First seen:2024-02-17 18:16:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 34c4161f659e591de8a4c6e215c7a951 (3 x RedLineStealer, 2 x Stealc, 1 x Nymaim)
ssdeep 6144:tGi0UFErSII8Yo2OWDa1zapDA6KnALOaUvs6+sFW3ChCBm8Z0pJ8JFE2DC:t6wgoHja1mpfKALO1vj+yIdSf2D
TLSH T16FA4F1127AE0E432CD9B84705434F7F4297AFCA1A578C08B37983F6F3D71692666A361
TrID 46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 292422242862342a (1 x RedLineStealer)
Reporter Bitsight
Tags:exe RedLineStealer


Avatar
Bitsight
url: http://193.233.132.232/1.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
518
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/476603/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a recently created process
Forced shutdown of a browser
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65d0f81e22703c3491a0eb1d/reports/9a3cdd80-5a5e-49c2-8c34-3e1fc0d1d140/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4a6cf87-0db0-470f-98b7-bdaa9f0518d3
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1393950
Signature
.NET source code contains very large array initializations
Detected unpacking (overwrites its own PE header)
Drops PE files to the startup folder
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2024-02-17 18:17:05 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
17 of 23 (73.91%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4nyrxr6ezbavjstmarehnoyfx45wuspwyki234zhqywqty5brpa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240217-ww1v1she3x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
b93b81e47fa5569de1f85ae01b52eb1963983e8f2fb9dc8e0511bf7357ad73f5
MD5 hash:
72798196a76873fbd69b0868e0bf8150
SHA1 hash:
d77ae50f56543c23eaa73c0790d0d3e332f0925e
Link:
https://www.unpac.me/results/c069008d-3341-4a8e-8cbc-fb256847a66c/
SH256 hash:
d0bc689366b419dc035bc7fff934d2c4e8b73f19e06d38aabf44c9e39d723510
MD5 hash:
baf26a9a9e834c91797471467abd7fcb
SHA1 hash:
82221b441d2e61f3536b2d3c8f14dd49695844d5
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/c069008d-3341-4a8e-8cbc-fb256847a66c/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
75f6a7c7bd89503e8d124ea03e84189de8e5c40db7627ce107c6a9dd5f3dadfe
MD5 hash:
42ae66204215563c60023c4a6f73c9a4
SHA1 hash:
4208a13397755bc97b66ddbfbbfb8901ccf067a4
Detections:
RedLine_Campaign_June2021
Create hunting rule
Link:
https://www.unpac.me/results/c069008d-3341-4a8e-8cbc-fb256847a66c/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
MD5 hash:
b193c3393e07c06375d39d92c352c011
SHA1 hash:
866b3f6fd77c703efb874eaf3cc518c3e86ac209
Link:
https://www.unpac.me/results/c069008d-3341-4a8e-8cbc-fb256847a66c/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8f1b88de3e26/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2756611/
  
URLhaus
https://urlhaus.abuse.ch/url/2763288/
Cape
Cape
https://www.capesandbox.com/analysis/476603/

Comments